Mastering ARP Commands on Linux: From Basics to Advanced Security Uses

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network, and Linux provides several commands to manage and diagnose ARP information.

Basic Concepts

IP address : Unique identifier for each device on a network.

MAC address : Hardware identifier for each network interface.

ARP cache : Table storing IP‑to‑MAC mappings.

Basic ARP Commands

1. Show ARP table

Use arp to list the current ARP cache.

arp -n

2. Clear ARP cache

Remove all entries with the -d option.

sudo arp -d -a

Advanced ARP Commands

1. Add a static ARP entry

Manually bind an IP to a MAC address using -s.

sudo arp -s <IP address> <MAC address>

2. Delete a specific ARP entry

Remove a particular mapping with -d and the target IP.

sudo arp -d <IP address>

Practical Use Cases

1. Discover network devices

Running arp -n shows all devices on the LAN, useful for monitoring.

arp -n

2. Clear stale ARP data

Out‑of‑date entries can cause connectivity problems; clearing the cache ensures fresh mappings.

sudo arp -d -a

3. Add static entries for special configurations

Static entries are helpful for virtual IPs, HA clusters, or when you need guaranteed IP‑MAC bindings.

sudo arp -s 192.168.1.100 00:11:22:33:44:55

4. Remove unwanted entries

Delete incorrect or malicious mappings to clean the cache.

sudo arp -d 192.168.1.100

5. Detect ARP cache poisoning

Identify abnormal MAC addresses (not all zeros or ones) with a simple filter.

arp -n | awk '!($3=="00:00:00:00:00:00") && !($3=="00:00:00:00:00:01") {print "Possible ARP poisoning:" $1 "->" $3}'

6. Monitor ARP traffic

Capture ARP requests and replies using tcpdump on the relevant interface.

sudo tcpdump -i eth0 arp

Security Considerations

ARP cache entries can be altered by man‑in‑the‑middle attacks; protect the ARP table by limiting who can add or modify static entries and by monitoring for suspicious changes.

Conclusion

Understanding and using ARP commands is essential for Linux network troubleshooting, configuration optimization, and defending against ARP‑related attacks.